Legal claims defining the scope of protection. Each claim is shown in both the original legal language and a plain English translation.
1. A system for preventing fraud of a web service offered by a service provider at a website, which comprises: a fake credential distributor for automatically creating a set of valid but fake credentials to access such website of the service provider and for distributing such set of fake credentials to a plurality of predefined websites; a fake user database including at least said set of fake credentials; a real-time monitor connected between any possible user connection to such website and the service provider for real-time monitoring any user login attempt from any origin network location to the website, and for comparing the credentials used in such user login attempt with the set of fake credentials in the fake user database, and if the credentials used in such user login attempt coincide with any fake credential in the fake user database, such origin network location is added to an internal list of tainted connections; and if there is any other login attempt of a user from an origin network location in said list of tainted connections, said user access request is refused, even when it is using real credentials and such user is redirected to a pre-established webpage not enabling such user to access the web service.
The fraud prevention system for a website creates fake but valid user credentials (usernames/passwords) and distributes them to multiple other websites (predefined "poisoned" websites). It then monitors all login attempts to the main website. If a login uses one of the fake credentials, the originating network location (e.g., IP address) is added to a list of "tainted" connections. Any subsequent login attempt from a tainted network location will be blocked, even if the user provides valid credentials, and the user is redirected to a page that prevents access to the web service. The purpose is to identify and block fraudulent users who obtain credentials from the "poisoned" websites.
2. The system according to claim 1 , wherein adding an origin network location to the internal list of tainted connections is carried out by means of IP address, geolocation, and/or persistent cookie injection.
The fraud prevention system described previously adds an origin network location to the "tainted connections" list by identifying its IP address, determining its geolocation, and/or injecting a persistent cookie into the user's browser. These methods help track and identify the originating source of the fraudulent login attempt and permanently block access from that user in the future even if the IP address is changed.
3. The system according to claim 1 , wherein each origin network location in the internal list of tainted connections is also associated with one of a plurality of predefined websites that have been poisoned.
In the fraud prevention system, each origin network location on the "tainted connections" list is associated with one of the predefined "poisoned" websites where the fake credentials were used. This association helps track which "poisoned" website was the source of the compromised credentials, allowing the system to potentially prioritize or adjust the "poisoning" of specific websites.
4. The system according to claim 1 , wherein a plurality of predefined websites to be poisoned is pre-populated by an external user of the system by means of an interface.
In the fraud prevention system, the list of predefined websites that are to be "poisoned" with fake credentials is set up by an external user (e.g., an administrator) through a user interface. The administrator can configure which websites should receive the fake credentials, thus controlling where the honeypot is deployed to catch credential thieves.
5. The system according to claim 1 , wherein each credential includes one or more of the following: username, password and PIN.
In the fraud prevention system, each fake (or real) user credential can include one or more of the following pieces of information: a username, a password, and a PIN. These elements, in combination, are used to generate the fake credentials that are distributed to the "poisoned" websites and used to identify fraudulent login attempts.
6. The system according to claim 2 , wherein each origin network location in the internal list of tainted connections is also associated with one of a plurality of predefined websites that have been poisoned.
The fraud prevention system adds an origin network location to the "tainted connections" list by identifying its IP address, determining its geolocation, and/or injecting a persistent cookie into the user's browser. Each origin network location on this list is also associated with one of the predefined "poisoned" websites where the fake credentials were used. This association helps track which "poisoned" website was the source of the compromised credentials, allowing the system to potentially prioritize or adjust the "poisoning" of specific websites.
7. The system according to claim 2 , wherein a plurality of predefined websites to be poisoned is pre-populated by an external user of the system by means of an interface.
The fraud prevention system adds an origin network location to the "tainted connections" list by identifying its IP address, determining its geolocation, and/or injecting a persistent cookie into the user's browser. The list of predefined websites that are to be "poisoned" with fake credentials is set up by an external user (e.g., an administrator) through a user interface. The administrator can configure which websites should receive the fake credentials, thus controlling where the honeypot is deployed to catch credential thieves.
8. The system according to claim 3 , wherein the plurality of predefined websites to be poisoned is pre-populated by an external user of the system by means of an interface.
In the fraud prevention system, each origin network location on the "tainted connections" list is associated with one of the predefined "poisoned" websites where the fake credentials were used. The list of predefined websites that are to be "poisoned" with fake credentials is set up by an external user (e.g., an administrator) through a user interface. The administrator can configure which websites should receive the fake credentials, thus controlling where the honeypot is deployed to catch credential thieves.
9. The system according to claim 6 , wherein the plurality of predefined websites to be poisoned is pre-populated by an external user of the system by means of an interface.
The fraud prevention system adds an origin network location to the "tainted connections" list by identifying its IP address, determining its geolocation, and/or injecting a persistent cookie into the user's browser. Each origin network location on this list is associated with one of the predefined "poisoned" websites where the fake credentials were used. The list of predefined websites that are to be "poisoned" with fake credentials is set up by an external user (e.g., an administrator) through a user interface. The administrator can configure which websites should receive the fake credentials, thus controlling where the honeypot is deployed to catch credential thieves.
10. The system according to claim 2 , wherein each credential includes one or more of the following: username, password and PIN.
The fraud prevention system adds an origin network location to the "tainted connections" list by identifying its IP address, determining its geolocation, and/or injecting a persistent cookie into the user's browser. Each fake (or real) user credential can include one or more of the following pieces of information: a username, a password, and a PIN. These elements, in combination, are used to generate the fake credentials that are distributed to the "poisoned" websites and used to identify fraudulent login attempts.
11. The system according to claim 3 , wherein each credential includes one or more of the following: username, password and PIN.
In the fraud prevention system, each origin network location on the "tainted connections" list is associated with one of the predefined "poisoned" websites where the fake credentials were used. Each fake (or real) user credential can include one or more of the following pieces of information: a username, a password, and a PIN. These elements, in combination, are used to generate the fake credentials that are distributed to the "poisoned" websites and used to identify fraudulent login attempts.
12. The system according to claim 4 , wherein each credential includes one or more of the following: username, password and PIN.
In the fraud prevention system, the list of predefined websites that are to be "poisoned" with fake credentials is set up by an external user (e.g., an administrator) through a user interface. Each fake (or real) user credential can include one or more of the following pieces of information: a username, a password, and a PIN. These elements, in combination, are used to generate the fake credentials that are distributed to the "poisoned" websites and used to identify fraudulent login attempts.
13. The system according to claim 6 , wherein each credential includes one or more of the following: username, password and PIN.
The fraud prevention system adds an origin network location to the "tainted connections" list by identifying its IP address, determining its geolocation, and/or injecting a persistent cookie into the user's browser. Each origin network location on this list is also associated with one of the predefined "poisoned" websites where the fake credentials were used. Each fake (or real) user credential can include one or more of the following pieces of information: a username, a password, and a PIN. These elements, in combination, are used to generate the fake credentials that are distributed to the "poisoned" websites and used to identify fraudulent login attempts.
14. The system according to claim 7 , wherein each credential includes one or more of the following: username, password and PIN.
The fraud prevention system adds an origin network location to the "tainted connections" list by identifying its IP address, determining its geolocation, and/or injecting a persistent cookie into the user's browser. The list of predefined websites that are to be "poisoned" with fake credentials is set up by an external user (e.g., an administrator) through a user interface. Each fake (or real) user credential can include one or more of the following pieces of information: a username, a password, and a PIN. These elements, in combination, are used to generate the fake credentials that are distributed to the "poisoned" websites and used to identify fraudulent login attempts.
15. The system according to claim 8 , wherein each credential includes one or more of the following: username, password and PIN.
In the fraud prevention system, each origin network location on the "tainted connections" list is associated with one of the predefined "poisoned" websites where the fake credentials were used. The list of predefined websites that are to be "poisoned" with fake credentials is set up by an external user (e.g., an administrator) through a user interface. Each fake (or real) user credential can include one or more of the following pieces of information: a username, a password, and a PIN. These elements, in combination, are used to generate the fake credentials that are distributed to the "poisoned" websites and used to identify fraudulent login attempts.
16. The system according to claim 9 , wherein each credential includes one or more of the following: username, password and PIN.
The fraud prevention system adds an origin network location to the "tainted connections" list by identifying its IP address, determining its geolocation, and/or injecting a persistent cookie into the user's browser. Each origin network location on this list is also associated with one of the predefined "poisoned" websites where the fake credentials were used. The list of predefined websites that are to be "poisoned" with fake credentials is set up by an external user (e.g., an administrator) through a user interface. Each fake (or real) user credential can include one or more of the following pieces of information: a username, a password, and a PIN. These elements, in combination, are used to generate the fake credentials that are distributed to the "poisoned" websites and used to identify fraudulent login attempts.
Unknown
September 2, 2014
Browse 5M+ US patents with plain-English claim translations and AI-generated analysis.